-- TEMPORARY policy, same pattern used for test_items. The Next.js app
-- has no Supabase Auth flow wired up yet, so it queries as the anon
-- role rather than authenticated -- without this, RLS silently filters
-- out every row (as with the original test_items issue).
--
-- TODO: remove this policy once real Supabase Auth is set up, and rely
-- on the "authenticated"-only select policy from 0001 (plus per-role
-- policies) instead.
create policy "TEMP: allow anon read access"
on invoices
for select
to anon
using (true);